A security audit has uncovered that some of the encryption keys used to secure the company B2B financial transactions with its partners may be too weak. The security administrator needs to implement a process to ensure that financial transactions will not be compromised if a weak encryption key is found. Which of the following should the security administrator implement?

Question

Accepted Answer

C. PFS should be implemented on all VPN tunnels. PFS on VPN tunnels causes the key exchange (typically via Diffie-Hellman) to generate a unique session key for every tunnel negotiation, completely independent of long-term keys. Even if a weak or compromised encryption key is discovered, the attacker cannot use it to decrypt previously captured or future sessions because each session key is discarded after use. This directly addresses the risk of a weak key exposing financial transaction data.

Answer

A. Entropy should be enabled on all SSLv2 transactions. SSLv2 is a deprecated, insecure protocol and enabling entropy on it does not provide meaningful protection; SSLv2 should be disabled entirely.

Answer

B. AES256-CBC should be implemented for all encrypted data. AES256-CBC improves encryption strength but does not prevent exposure of historical sessions if a session key is compromised, because it lacks forward secrecy.

Answer

D. PFS should be implemented on all SSH connections. PFS on SSH connections does not protect B2B financial transactions conducted over VPN tunnels, as SSH and VPN are separate communication channels.

A security audit has uncovered that some of the encryption keys used to secure the company B2B financial transactions with its partners may be too weak. The security administrator needs to implement…

Question

Options

How the community answered

Why each option

Topics

Community Discussion